This reinstates the old behavior of Error.captureStackTrace prior to
4feafee9.  Like the builtin Error constructors, captureStackTrace now formats
the stack trace lazily once it is accessed.

Bug: v8:5962
Change-Id: I03821b73d26b7b40809a1fea98f9c820bfa05d6b
Reviewed-on: https://chromium-review.googlesource.com/574530Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46727}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/63efa35..1808a90

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/af47a93..44b022b

TBR=machenbach@chromium.org,hablich@chromium.org

Change-Id: Icf22a76859f0897d97ca68de61850cef1a607f26
Reviewed-on: https://chromium-review.googlesource.com/575868Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46726}

Change-Id: I091a1f4a1f2292b37a56520d0a5c46ac5781b459
Reviewed-on: https://chromium-review.googlesource.com/575515Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46725}

NOTREECHECKS=true

Bug: 
Change-Id: I6c4d76be9f032d1149a5128c90995b7302c9d9b5
Reviewed-on: https://chromium-review.googlesource.com/574697
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46724}

Previously,
  ➜  v8 (master) ✔ ./out.gn/x64.optdebug/d8
  V8 version 6.1.0 (candidate)
  d8> var x = undefined
  undefined
  d8> var [a] = x
  (d8):1: TypeError: Cannot read property 'Symbol(Symbol.iterator)' of undefined
  var [a] = x
            ^
  TypeError: Cannot read property 'Symbol(Symbol.iterator)' of undefined
      at (d8):1:11

Now,
  ➜  v8 (fix-iterator) ✔ ./out.gn/x64.optdebug/d8
  V8 version 6.1.0 (candidate)
  d8> var x = undefined
  undefined
  d8> var [a] = x
  (d8):1: TypeError: x is not iterable
  var [a] = x
            ^
  TypeError: x is not iterable
      at (d8):1:11


Bug: v8:6599, v8:6513
Change-Id: I71287a19166af0289e8f7708b8f41ad003ae87ae
Reviewed-on: https://chromium-review.googlesource.com/571175
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46723}

Also, add a couple of macros to handle error cases.

R=adamk@chromium.org

Bug: chromium:744292
Change-Id: I5dcb19ce67ec1aa4318d68d973d304cb07a65b80
Reviewed-on: https://chromium-review.googlesource.com/575394
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46722}

This was previously used by our js builtins but they no longer
exist. This has been exposed to API which means we can't remove it
just yet. Moving to CPP for now to save binary size.

Bug: v8:5343
Change-Id: I2a3e5a4169310b2ba13ce13f0386336e9733d71f
Reviewed-on: https://chromium-review.googlesource.com/575024Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46721}

Now the concurrent marker skips the weak fields of AllocationSites.

BUG=chromium:694255

Change-Id: If920b6a14fa12c3a90ab0d283e22988ccbd48c0e
Reviewed-on: https://chromium-review.googlesource.com/574907
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46720}

This reverts commit a72b2f88.

Reason for revert: Breaks https://build.chromium.org/p/client.v8.ports/builders/V8%20Linux%20-%20arm64%20-%20sim%20-%20debug/builds/7093

Original change's description:
> [arm] Restrict grouping pushes before a TailCall to registers only
> 
> We optimize parallel moves performed before a TailCall by grouping adjacent
> pushes. This way, we may use a single instruction to push multiple registers at
> once. However, we also have support for pushing immediates and stack slots for
> which the benefit is questionnable therefore this patch removes support for
> them.
> 
> Concerning immediate pushes, it looks like a mistake since we do not have
> support for this case in `AssembleMove` so this patch removes it. Furthermore,
> if we add a test for this case, we see that a `push ip` instruction is
> generated, effectively pushing whatever was in `ip` at the time instead of
> pushing a constant.
> 
> Concerning stack slot pushes, we generate a more or less equivalent sequence of
> instructions.
> 
> Finally, grouping floating point pushes is not used anywhere so this patch
> removes support for this also.
> 
> Bug: v8:6553
> Change-Id: I9b820d33361fc442dd813f66e1f96cda41009110
> Reviewed-on: https://chromium-review.googlesource.com/567191
> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
> Commit-Queue: Pierre Langlois <pierre.langlois@arm.com>
> Cr-Commit-Position: refs/heads/master@{#46718}

TBR=danno@chromium.org,jarin@chromium.org,pierre.langlois@arm.com,bmeurer@chromium.org

Change-Id: Ib9db9e6e4f033aeea32741e04b1b884429acc800
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:6553
Reviewed-on: https://chromium-review.googlesource.com/574908Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46719}

We optimize parallel moves performed before a TailCall by grouping adjacent
pushes. This way, we may use a single instruction to push multiple registers at
once. However, we also have support for pushing immediates and stack slots for
which the benefit is questionnable therefore this patch removes support for
them.

Concerning immediate pushes, it looks like a mistake since we do not have
support for this case in `AssembleMove` so this patch removes it. Furthermore,
if we add a test for this case, we see that a `push ip` instruction is
generated, effectively pushing whatever was in `ip` at the time instead of
pushing a constant.

Concerning stack slot pushes, we generate a more or less equivalent sequence of
instructions.

Finally, grouping floating point pushes is not used anywhere so this patch
removes support for this also.

Bug: v8:6553
Change-Id: I9b820d33361fc442dd813f66e1f96cda41009110
Reviewed-on: https://chromium-review.googlesource.com/567191Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Pierre Langlois <pierre.langlois@arm.com>
Cr-Commit-Position: refs/heads/master@{#46718}

Bug: chromium:738865
Change-Id: Ic30a3e1012771d2e37b0e10aa59ab348a40bac10
Reviewed-on: https://chromium-review.googlesource.com/574714Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46717}

Now the concurrent marker pushes these objects in the bailout worklist
so that the main thread can perform wrapper tracing.

BUG=chromium:694255

Change-Id: I64f194334458fbabf16a63a8ae570456cb5fee19
Reviewed-on: https://chromium-review.googlesource.com/574603
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46716}

Bug: chromium:738865
Change-Id: I4c8aa8c90ba401200222d95d6395c022fc023a71
Reviewed-on: https://chromium-review.googlesource.com/574535
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46715}

BUG=chromium:743622

Change-Id: Ic29a39d5976425eda2358c7e5ace0efa1b78a718
Reviewed-on: https://chromium-review.googlesource.com/574604Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46714}

Added a flag, process_size, to collect the maximum memory size used by
a test run.

Bug: 
Change-Id: I5d659ff03bfcf7ab4a868aafbda3303ffcb9fa78
Reviewed-on: https://chromium-review.googlesource.com/542415
Commit-Queue: Mircea Trofin <mtrofin@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46713}

Add a default clause to the switch statement in debug::GetBuiltin() and
abort if it is reached.

Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I8895497b64ccd3b8eb23d281b8bca4405a5c3959
Reviewed-on: https://chromium-review.googlesource.com/574172Reviewed-by: Jochen Eisinger <jochen@chromium.org>
Commit-Queue: Ben Noordhuis <info@bnoordhuis.nl>
Cr-Commit-Position: refs/heads/master@{#46712}

This is the ia32 implementation of the CL
https://codereview.chromium.org/2763593002

Original message:

[wasm][arm] Add an additional stack check for functions with big frames.

Stack overflow checks are typically implemented as part of the TurboFan
graph of a function. This means that the stack check code is executed
after frame construction. When a frame is too big, though, there may not
be enough space on the stack anymore to throw the stack overflow
exception after frame construction. With this CL we do an additional
stack check before frame construction for functions with big frames.

As discussed offline with mstarzinger, I do this change currently only
for WebAssembly.

This CL contains only the changes for arm. I will do the other platforms
in separate CLs.

Bug:v8:6318

R=neis@chromium.org, titzer@chromium.org

Change-Id: Ibeedc5c4c4571cffd3a9c58016ddc44b64e2bf02
Reviewed-on: https://chromium-review.googlesource.com/568305
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46711}

This makes sure Runtime_ArrayBufferNeuter fails gracefully on array
buffers that are non-neuterable. Note that this runtime function is
whitelisted on ClusterFuzz and otherwise only used for testing.

R=cbruni@chromium.org
BUG=chromium:743215,v8:6534

Change-Id: I5069e615468f8789bf4fd87bb1e093a18bfd0347
Reviewed-on: https://chromium-review.googlesource.com/574168Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46710}

R=petermarshall@chromium.org

Change-Id: If181ed625015105f8bbabf29a9db3cfcf090b80a
Reviewed-on: https://chromium-review.googlesource.com/574235Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46709}

Bug: chromium:738865
Change-Id: Icc3e292ded7f4097ef266d8db80f273a412a8b92
Reviewed-on: https://chromium-review.googlesource.com/565718
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46708}

InstructionSelector::VisitInt32Mul

TEST=cctest/test-run-machops/RunInt32MulAndInt32AddP,mjsunit/asm/int32mod-constant

Bug: 
Change-Id: Iaccfc0d0c981e7c7e2f8b06ff3812fe60d1f85d3
Reviewed-on: https://chromium-review.googlesource.com/574367Reviewed-by: Miran Karić <Miran.Karic@imgtec.com>
Commit-Queue: Ivica Bogosavljevic <ivica.bogosavljevic@imgtec.com>
Cr-Commit-Position: refs/heads/master@{#46707}

Bug=chromium:740784
LOG=N

Change-Id: I61fe1b07426d0b1e5131687c9ce99a8dbfa09781
Reviewed-on: https://chromium-review.googlesource.com/574175
Commit-Queue: Daniel Clifford <danno@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46706}

This removes a special case for {IfSuccess} control projections from the
effect-control linearizer that is no longer needed now that such control
projections only appear in pairs.

R=jarin@chromium.org

Change-Id: I4d872ad301d09e7424b249fb7c4eb70353a9d3ff
Reviewed-on: https://chromium-review.googlesource.com/574228Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46705}

This replaces four heap allocations by one stack allocated value.

R=mstarzinger@chromium.org

Change-Id: I7d00968d7bddadb51d7c7b1f3bc5253e54c8a3f9
Reviewed-on: https://chromium-review.googlesource.com/574025
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46704}

If the incremental marker discovers more marking work and the concurrent
marking tasks have already exited, then new concurrent marking tasks
are scheduled to help the main thread marker.

BUG=chromium:694255

Change-Id: I559af62790e6034b23a412d3308ba8b6ae3d27c9
Reviewed-on: https://chromium-review.googlesource.com/574170Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46703}

This reverts commit a2fcdc7c.

Reason for revert: Large regressions in RCS (https://chromeperf.appspot.com/group_report?bug_id=740126)

Original change's description:
> [runtime] Move profiler ticks from SFI to feedback vector
> 
> Instead of counting profiler ticks on the shared function info (which is
> shared between native contexts), count them on the feedback vector
> (which is not). This allows us to continue pushing optimization
> decisions off the SFI, onto the feedback vector.
> 
> Note that a side-effect of this is that ICs don't have to walk the stack
> to reset profiler ticks, as they can access the feedback vector directly
> from their feedback nexus.
> 
> Change-Id: I232ae9e759fca75cd89d393148a4ff42caa2646f
> Reviewed-on: https://chromium-review.googlesource.com/544888
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> Commit-Queue: Leszek Swirski <leszeks@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#46411}

TBR=rmcilroy@chromium.org,leszeks@chromium.org,ishell@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Change-Id: Id587e4172e300c420f93c49744a2a0e66696edf8
Reviewed-on: https://chromium-review.googlesource.com/574227
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46702}

Some of the benchmarks were pointing to the wrong test functions.

Bug: 
Change-Id: I6f7850feec1da61bea7b8c1ac03c00d75400f458
Reviewed-on: https://chromium-review.googlesource.com/574023Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Georgia Kouveli <georgia.kouveli@arm.com>
Cr-Commit-Position: refs/heads/master@{#46701}

Bug: v8:6000
Change-Id: I2853d44d8bcf34b28630594cc9c2782046bd4b28
Reviewed-on: https://chromium-review.googlesource.com/573900Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46700}

Most of these functions have become unusued due to Crankshaft's removal, so
delete them.

Bug: 
Change-Id: If4724c78a0b5c7b6179b22eb4068acd95dfdd29e
Reviewed-on: https://chromium-review.googlesource.com/571011Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Martyn Capewell <martyn.capewell@arm.com>
Cr-Commit-Position: refs/heads/master@{#46699}

There are wasm tests which are supposed to fail, but they fail for the
wrong reason (because blocks do not declare their type).
This CL fixes this, and changes the error output to contain the
expected and observed results for better debuggability.

R=titzer@chromium.org

Change-Id: Ibbd7883e43677a91f858575578586c9e9d1641d5
Reviewed-on: https://chromium-review.googlesource.com/571810Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46698}

Bug: chromium:738865
Change-Id: If710b60d33eea94bff7b621910006c2d941a7670
Reviewed-on: https://chromium-review.googlesource.com/571900Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46697}

Change-Id: Ib233e9801d5deed1acde36620d033d19957319d0
Bug: v8:6604
Reviewed-on: https://chromium-review.googlesource.com/573781Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46696}

This is for infra-side:
https://chromium-review.googlesource.com/c/573544

NOTRY=true

Bug: chromium:726584
Change-Id: I0dbe8cf8e107ad13d284dd2347935a225261abe8
Reviewed-on: https://chromium-review.googlesource.com/573545
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46695}

This makes the runtime rely on the {HasBytecodeArray} predicate to
determine whether code generated by TurboFan was build without any
deoptimization support, as opposed to {asm_function}.

R=rmcilroy@chromium.org
BUG=v8:6589

Change-Id: Id124bed47a5fa02d31ff8fd3eee561b2df6c9226
Reviewed-on: https://chromium-review.googlesource.com/571786Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46694}

Objects created during bootstrapping do not need a transition
tree except for elements kind transitions.

R=ishell@chromium.org

Bug: v8:6596
Change-Id: I237b8b2792f201336e1c9731c815095dd06bc182
Reviewed-on: https://chromium-review.googlesource.com/571750Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46693}

In many cases, this is performance neutral because we can fall off 
the JavaScript monomorphic fast path for the hash lookup.
Once we store the hash code in known fixed position, this should
get much faster.

Change-Id: I3bb52ee6482fe2c35b7abe70c1d0c21935c6cc1d
Reviewed-on: https://chromium-review.googlesource.com/566679
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46692}

Change-Id: Ie59254ff0790a2db70c1f620f287f8de6387ad23
Bug: v8:5717
Reviewed-on: https://chromium-review.googlesource.com/573543Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46691}

BUG=chromium:738469

Review-Url: https://codereview.chromium.org/2975133002
Cr-Commit-Position: refs/heads/master@{#46690}

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/9cb83ca..63efa35

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/90038ee..af47a93

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/f6f6b65..844603c

TBR=machenbach@chromium.org,hablich@chromium.org

Change-Id: I114ee4d225032558289521a6ec2ff5a25898d9df
Reviewed-on: https://chromium-review.googlesource.com/572529Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46689}

Previous Fuchsia SDK versions provide an empty header file, for
convenience, but this is no longer the case.

Change-Id: Ica8d23cc38664b3ebe7093606da4c669d6043c73
Reviewed-on: https://chromium-review.googlesource.com/571763Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Wez <wez@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46688}